aboutsummaryrefslogtreecommitdiffstats
path: root/test/v3ext.c
Commit message (Collapse)AuthorAgeFilesLines
* x509: keep RFC 3779 stacks hole-free after a failed canonizeMounir IDRASSI2026-07-271-21/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ASIdentifierChoice_canonize and IPAddressOrRanges_canonize left NULL slots in the live stack when a merge succeeded before a later failure (overlap, inverted range, or OOM). The NULLs were closed up only on the success path, so a failed X509v3_asid_canonize() / X509v3_addr_canonize() left the object poisonable: a retry of either function dereferences a NULL in the sort comparator during the re-sort, the i2r extension printers dereference the hole when printing (both in all builds), and on the asid side is_canonical trips extract_min_max's ossl_assert(aor != NULL), an abort in debug builds. This is a regression introduced by e59165a1e3 ("crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweep"): the previous delete-per-merge loop kept the stack hole-free at every step, so a failed canonize always left the object sorted, partially merged and structurally valid. Run the compaction pass unconditionally, whether the sweep succeeded or failed, restoring that contract: the stack is always left partially canonicalized but hole-free, safe to inspect, print, encode, free, or retry. In v3_addr.c this also routes the bare return-0 error paths through the done: cleanup label. New tests cover the crash vectors (is_canonical then retry) on both the asid and addr sides. The existing *_error_midsweep tests are strengthened with the same inspect/retry assertions. Fixes #31856 Assisted-by: ZCode:GLM-5.2 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 27 07:59:21 2026 (Merged from https://github.com/openssl/openssl/pull/31857)
* crypto/x509: replace O(N^2) RFC 3779 canonicalisation merge with linear sweepNiels Provos2026-07-031-0/+598
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ASIdentifierChoice_canonize and IPAddressOrRanges_canonize previously merged adjacent entries with an in-place loop that called sk_..._delete() after each merge, making the merge O(N^2) due to the per-merge stack shift. Replace the merge with a single linear sweep using a write index distinct from the read cursor: mergeable entries fold into the previous output's upper bound in O(1), non-mergeable entries are slid forward into the write slot, and the source slot is set to NULL so the ASN.1 free machinery cannot double-free on a subsequent abort. Canonicalisation is now O(N log N) overall, bounded by the existing sort. Mixed-state-on-error safety is provided by the caller's normal teardown path: OPENSSL_sk_pop unlinks without freeing, OPENSSL_sk_set replaces without freeing the displaced value, and ossl_asn1_item_embed_free no-ops on NULL slots, so returning early on an inner failure leaves the stack in a state that the choice's normal free path handles cleanly. New regression tests in test/v3ext.c at N=8192 cover the all-merge, no-merge, interleaved (slide-forward), range-merge, overlap-mid-sweep, and inverted-range-mid-sweep paths; the mixed-state teardown invariant is exercised under ASan + UBSan. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Fri Jul 3 19:20:01 2026 (Merged from https://github.com/openssl/openssl/pull/31147)
* Copyright year updatesopenssl-machine2026-03-101-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* Make ASN1_STRING opaqueBob Beck2026-02-251-0/+2
| | | | | | | | | | | | | | | | | This laudable goal, should it land, will be followed with an issue raised to eat our own dogfood and find every file with <crypto/asn1.h> added to it in this commit, and change to the appropriate accessors, which should be possible in most places we aren't actually implementing things that change the values Fixes: https://github.com/openssl/openssl/issues/29860 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Feb 25 10:14:57 2026 (Merged from https://github.com/openssl/openssl/pull/29862)
* 4.0-POST-CLANG-FORMAT-WEBKIT4.0-POST-CLANG-FORMAT-WEBKITBob Beck2025-12-091-70/+66
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29242)
* Copyright year updatesopenssl-machine2025-09-021-1/+1
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Release: yes
* test: Silence warnings on Win64 buildsTomas Mraz2025-07-021-1/+1
| | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27806)
* Fix goto label indents to match styleViktor Dukhovni2025-03-281-1/+1
| | | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27175)
* Copyright year updatesTomas Mraz2024-09-051-1/+1
| | | | | Reviewed-by: Neil Horman <[email protected]> Release: yes
* Avoid memory leak in x509_test error pathViktor Dukhovni2024-05-081-3/+12
| | | | | | | | Fixes #23897 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23991)
* Fix coverity issues in X509v3_addrslontis2022-11-211-0/+44
| | | | | | | | | | CID 1516955 : Null pointer deref (REVERSE_INULL) CID 1516954 : Null pointer deref (REVERSE_INULL) CID 1516953 : RESOURCE_LEAK of child Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19700)
* Add test to confirm IPAddressFamily_check_len catches invalid lenGraham Woodward2022-11-161-0/+87
| | | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19273)
* Fix a crash in v2i_IPAddrBlocks()Matt Caswell2022-07-221-0/+99
| | | | | | | | | | | | If an IP address prefix value is supplied that is too large then a crash can result. v2i_IPAddrBlocks() should sanity check the prefix value, as should X509v3_addr_add_prefix(). Reported by Theo Buehler (@botovq) Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18523)
* Add missing header for memcmpGregor Jasny2022-07-061-0/+1
| | | | | | | | | | CLA: trivial Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Todd Short <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18719)
* Fix range_should_be_prefix() to actually return the correct resultMatt Caswell2022-06-281-0/+111
| | | | | | | | | | | | | | | | | | range_should_be_prefix() was misidentifying whether an IP address range should in fact be represented as a prefix. This was due to a bug introduced in commit 42d7d7dd which made this incorrect change: - OPENSSL_assert(memcmp(min, max, length) <= 0); + if (memcmp(min, max, length) <= 0) + return -1; This error leads to incorrect DER being encoded/accepted. Reported by Theo Buehler (@botovq) Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18524)
* Fix compile issues in test/v3ext.c with no-rfc3779Bernd Edlinger2022-06-231-0/+4
| | | | | | | | | | There are no ASIdentifiers if OPENSSL_NO_RFC3779 is defined, therefore the test cannot be compiled. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18634)
* Fix a crash in X509v3_asid_subset()Matt Caswell2022-06-151-0/+78
| | | | | | | | | | | | | If the asnum or rdi fields are NULL and the ASIdentifiers are otherwise subsets then this will result in a crash. Of note is that rdi will usually be NULL. Reported by Theo Buehler (@botovq) Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Todd Short <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18514)
* Update copyright yearMatt Caswell2020-04-231-1/+1
| | | | | Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/11616)
* Fix common test framework optionsMatt Caswell2020-02-031-0/+5
| | | | | | | | | | | | | | | | | | | | | PR#6975 added the ability to our test framework to have common options to all tests. For example providing the option "-test 5" to one of our test programs will just run test number 5. This can be useful when debugging tests. Unforuntately this does not work well for a number of tests. In particular those tests that call test_get_argument() without first skipping over these common test options will not get the expected value. Some tests did this correctly but a large number did not. A helper function is introduced, test_skip_common_options(), to make this easier for those tests which do not have their own specialised test option handling, but yet still need to call test_get_argument(). This function call is then added to all those tests that need it. Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/10975)
* Updated test command line parsing to support commmon commandsShane Lontis2019-02-111-1/+3
| | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/6975)
* Following the license change, modify the boilerplates in test/Richard Levitte2018-12-061-1/+1
| | | | | Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/7767)
* Update the test framework so that the need for test_main is removed. EverythingPauli2017-07-261-10/+4
| | | | | | | | | | | | | | | | | | | | that needed test_main now works using the same infrastructure as tests that used register_tests. This meant: * renaming register_tests to setup_tests and giving it a success/failure return. * renaming the init_test function to setup_test_framework. * renaming the finish_test function to pulldown_test_framework. * adding a user provided global_init function that runs before the test frame work is initialised. It returns a failure indication that stops the stest. * adding helper functions that permit tests to access their command line args. * spliting the BIO initialisation and finalisation out from the test setup and teardown. * hiding some of the now test internal functions. * fix the comments in testutil.h Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/3953)
* Adapt all test programsRichard Levitte2017-04-241-1/+0
| | | | | Reviewed-by: Rich Salz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/3243)
* WIP: Convert ui,v3ext,verify_extra_testRich Salz2017-04-141-15/+27
| | | | | | verify_extra_test still failing :( Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/3194)
* Add some accessor API'sRich Salz2016-06-081-0/+42
GH1098: Add X509_get_pathlen() (and a test) GH1097: Add SSL_is_dtls() function. Documented. Reviewed-by: Matt Caswell <[email protected]>
generated by cgit (git 2.51.2) at 2026-10-25 16:05:48 +0100